# CVE-2015-9545: xdLocalStorage improper input validation in origin verification

Source: https://junglewise.ai/threats/cve-2015-9545-xdlocalstorage-improper-input-validation-in-origin-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-9545 · Severity: low · CVSS 3.1 · Published 2021-12-09

xdLocalStorage is a JavaScript library that enables cross-domain access to browser local storage. The library fails to validate the origin of incoming web messages, allowing an attacker to craft a malicious webpage that, when visited by a user, can read or modify sensitive data stored by legitimate websites in the victim's browser. This could lead to account compromise or exposure of user credentials and private information.

Technologies: [xdlocalstorage (npm)](https://junglewise.ai/threats/technologies/xdlocalstorage). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-9545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-9545 being exploited in the wild.

**How severe is CVE-2015-9545?** Low severity, with a CVSS score of 3.1, published 9 December 2021.

**Which products and versions are affected?** xdlocalstorage (npm) SEMVER:introduced=0,last_affected=2.0.5.

**Is there a fix for CVE-2015-9545?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2015-9545 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2015-9545?** Check whether you run xdlocalstorage (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw (CWE-20) in the receiveMessage() function of xdLocalStorage.js. The function processes cross-origin messages via the postMessage API without validating the origin of the sender. This allows a malicious attacker controlling a website to send crafted messages that access or tamper with local storage data from other domains. The attack requires user interaction (visiting a malicious site), and can result in both confidentiality and integrity violations of local storage data. The vulnerability affects xdLocalStorage versions through 2.0.5; patches addressing origin validation are available.

## Affected products

- xdLocalStorage xdLocalStorage through 2.0.5

## Identifiers

- CVE-2015-9545
- GHSA-76qm-4f93-fg6f

## Timeline

- 2015-08-13: disclosed: Issue opened on GitHub describing missing origin whitelisting
- 2020-04-07: advisory: CVE-2015-9545 published in NVD
- 2021-12-09: advisory: GHSA-76qm-4f93-fg6f advisory published

## References

- [https://github.com/ofirdagan/cross-domain-local-storage/issues/17](https://github.com/ofirdagan/cross-domain-local-storage/issues/17)

## Related threats

- [xdlocalstorage missing request origin verification](https://junglewise.ai/threats/cve-2020-11610-xdlocalstorage-missing-request-origin-verification)
- [xdLocalStorage open redirect via unsafe postMessage targetOrigin](https://junglewise.ai/threats/cve-2020-11611-xdlocalstorage-open-redirect-via-unsafe-postmessage-targetorigin)
- [xdLocalStorage improper input validation in postMessage handler](https://junglewise.ai/threats/cve-2015-9544-xdlocalstorage-improper-input-validation-in-postmessage-handler)